Readable automation, data, integration, orchestration, and AI workflow language.
PeaLang is an embeddable extension language designed for rules, workflows, integrations, data processing, automation, and controlled application customization.
PeaLang is designed to complement existing ecosystems such as Python, FastAPI, Java, TypeScript, React, databases, messaging systems, and enterprise applications rather than replace them.
Current version: 0.99.6
Release type: Security Hardening / Pre-1.0
PeaLang v0.99.6 is a security-focused release following the v0.99.5 compatibility and release-readiness work.
The release addresses security findings identified after enabling GitHub CodeQL analysis against the reconstructed PeaLang repository history.
No new major feature family is introduced in v0.99.6.
The objective is to improve security while preserving the existing PeaLang language, runtime, SDK, data, integration, orchestration, ML, tooling, and enterprise capabilities.
PeaLang SFTP connections now fail closed for unknown SSH host keys.
The previous option that could automatically trust an unknown SSH host has been removed.
SFTP now requires trusted host-key information through configured or system known-hosts data.
This reduces exposure to SSH machine-in-the-middle attacks.
The legacy HMAC package-signing subsystem remains available for backwards-compatible controlled/internal workflows.
However, legacy trust-store metadata no longer copies the HMAC shared secret into the trust-store JSON.
For public package authenticity, PeaLang's existing Ed25519 signing infrastructure remains the recommended mechanism.
The type-system source analyzer has been hardened against pathological source input and expensive regular-expression behavior.
v0.99.6 introduces:
- bounded type-expression input
- bounded type-check source input
- safer structural matching
- reduced use of ambiguous arbitrary-text regular expressions
- adversarial regression tests
Current safety limits:
- Maximum individual type expression: 65,536 characters
- Maximum type-check source input: 2,000,000 characters
These limits protect static analysis from unreasonable or deliberately pathological input.
v0.99.6 adds dedicated regression coverage for:
- unknown SSH host-key handling
- signing trust-store secret exposure
- oversized type expressions
- oversized type-check source
- pathological type-system input
The v0.99.6 local regression suite completed successfully:
612 passed
0 failed
Python package generation also completed successfully for:
pealang-0.99.6-py3-none-any.whl
pealang-0.99.6.tar.gz
GitHub CodeQL should be rerun against the v0.99.6 commit before the release is considered fully security-closed.
The target is:
CodeQL High alerts: 0
PeaLang requires Python 3.10 or newer.
Clone the repository:
git clone https://github.com/PeaBox-Lab/PeaLang.git
cd PeaLang
Create a virtual environment:
Windows:
py -m venv .venv
.venv\Scripts\activate
Linux/macOS:
python3 -m venv .venv
source .venv/bin/activate
Install PeaLang:
python -m pip install --upgrade pip
pip install -e .
Verify installation:
pea --help
or:
pealang --help
If you have the v0.99.6 wheel:
pip install pealang-0.99.6-py3-none-any.whl
Create:
hello.pea
Add:
let name = "PeaLang"
print "Hello " + name
Run:
pea run hello.pea
let total = 0
for x in [1, 2, 3, 4, 5] {
total += x
}
print total
PeaLang supports core language constructs including:
- variables and constants
- functions
- control flow
- loops
- collections
- modules
- imports
- exceptions
- optional static typing
- asynchronous execution
- compiler and bytecode VM
- standard library
- embedding APIs
PeaLang supports optional type contracts while retaining compatibility with untyped programs.
Example:
function add(a: Int, b: Int) -> Int {
return a + b
}
let result: Int = add(10, 20)
print result
Type-check a program:
pea typecheck program.pea
PeaLang includes support for:
- primitive types
- records
- nullable types
- unions
- generics
- protocols
- generic substitution
- type inference foundations
- Result
- Option
- Future
- function contracts
- semantic analysis
PeaLang provides both a tree-walking interpreter and portable bytecode virtual machine.
Compile:
pea compile program.pea
Run using the VM:
pea vm program.pea
PeaLang's bytecode/VM architecture includes:
- portable PEAC bytecode
- compiler
- constant pool
- stack virtual machine
- function call frames
- closures
- exception handling
- module imports
- source mapping
- resource accounting
- async suspension and resume
- debugger integration
PeaLang is intended to operate as an extension language inside existing applications.
Supported integration directions include:
- Python
- FastAPI
- Java
- TypeScript
- React
- browser/WebAssembly environments
The goal is not to replace host languages.
Instead:
Host Application
|
+-- Python
+-- Java
+-- FastAPI
+-- React
|
+-- PeaLang
|
+-- Rules
+-- Workflows
+-- Automation
+-- Integration
+-- Data processing
+-- Controlled user extensions
PeaLang includes a growing data-processing and data-engineering stack.
Capabilities include:
- DataFrame
- LazyFrame
- schema inference
- CSV
- JSON
- JSONL
- transformations
- joins
- group-by
- aggregations
- expressions
- null handling
- pivot/unpivot
- window operations
- analytics
- statistics
- time-series processing
- forecasting
- scalable execution
- partitioning
- spill processing
PeaLang includes database and connector foundations for environments including:
- SQLite
- DuckDB
- PostgreSQL
- MySQL/MariaDB
- SQL Server
- Oracle
- REST
- GraphQL
- OData
- SFTP
- S3
- Azure Blob Storage
- Azure Data Lake Storage
- Google Cloud Storage
- Microsoft Graph
- SharePoint
Optional third-party dependencies may be required for individual connectors.
PeaLang includes streaming and messaging capabilities including:
- Kafka
- RabbitMQ
- WebSocket messaging
- event-time processing
- watermarks
- late-event handling
- tumbling windows
- sliding windows
- checkpointing
- replay
- idempotent delivery
PeaLang includes DAG-based orchestration support.
Capabilities include:
- DAG definitions
- task dependencies
- cycle detection
- topological ordering
- execution layers
- retries
- backoff
- persistent state
- scheduling
- logical execution dates
- run history
- backfill
- idempotency
PeaLang includes dependency-light machine-learning and production-ML foundations.
Capabilities include:
- preprocessing
- linear regression
- logistic regression
- evaluation metrics
- cross-validation
- regularization
- multiclass classification
- model persistence
- pipelines
- model governance
- inference
- model monitoring
- drift diagnostics
- fairness diagnostics
- calibration
- model registry
- serving
- MLOps
- optional ONNX Runtime integration
- optional PyTorch interoperability
PeaLang contains engine-neutral distributed execution foundations with optional adapters for:
- local execution
- Apache Arrow
- Polars
- Apache Spark
The architecture is intended to allow PeaLang execution plans to use different processing engines without forcing PeaLang programs to be rewritten around a specific backend.
PeaLang includes operational foundations for:
- FastAPI serving
- distributed serving
- rate limits
- concurrency limits
- timeouts
- health checks
- readiness checks
- deployment state
- observability
- OpenTelemetry integration
- Kubernetes deployment
- Kubernetes security controls
- graceful shutdown
- rollback
Security is a core PeaLang design concern.
PeaLang includes capabilities covering:
- capability-controlled execution
- runtime resource limits
- secure package handling
- SHA-256 integrity verification
- Ed25519 package signatures
- signed registry metadata
- key rotation/revocation foundations
- HTTPS-only registry policies
- secret-provider abstractions
- dependency-confusion defenses
- safe package extraction
- security regression tests
- SBOM generation
- provenance
- release integrity
- supply-chain verification
- GitHub CodeQL scanning
Unknown SSH hosts are rejected by default in v0.99.6.
Do not disable host-key verification in production integrations.
For public package distribution, use PeaLang's Ed25519 public/private-key signing infrastructure.
Legacy HMAC support exists primarily for backwards-compatible controlled/internal environments.
Never commit:
- passwords
- API keys
- access tokens
- signing private keys
- SSH private keys
- database credentials
.envfiles containing secrets
Supply credentials at runtime using an appropriate secret-management mechanism.
PeaLang provides a stable std.* namespace covering common application functionality.
Inspect available modules using:
pea stdlib
The standard-library architecture includes explicit capability gates for sensitive operations such as:
- filesystem access
- HTTP/network access
- logging
- concurrency
Run the complete Python test suite:
python -m pytest -q
The v0.99.6 release baseline passes:
612 tests
PeaLang also maintains conformance, compatibility, security, retention, and release-readiness tests.
The repository contains GitHub Actions workflows covering:
Windows / Linux / macOS
Python 3.10
Python 3.11
Python 3.12
Python 3.13
Additional workflows cover:
Java 17
Java 21
Node 20
Node 22
Node 24
=======
A modern, embeddable programming language and runtime for application scripting, data engineering, orchestration, streaming, machine learning, and distributed workloads.
Current release: v0.99.5
Status: Pre-1.0 / Release Candidate Stabilization
PeaLang is a general-purpose programming language and runtime designed to work both as a standalone language and as an embeddable extension layer for existing applications.
The project has evolved from a lightweight interpreter into a broader language platform with compilation, bytecode execution, type checking, debugging, packaging, data processing, connectors, orchestration, streaming, machine learning, distributed execution, security, and release-integrity tooling.
PeaLang is currently in the final stabilization and certification phase leading to v1.0.0.
PeaLang includes:
- Interpreter and parser
- Compiler and bytecode VM
- Static and runtime type-system capabilities
- Modules and package management
- Standard library
- Async and structured concurrency
- Debug Adapter Protocol support
- Application embedding
- Python integration
- FastAPI integration
- Java SDK
- TypeScript SDK
- React SDK
- Browser/WASM integration
- SQL and database connectivity
- DataFrame processing
- Cloud and object-storage connectors
- Analytics and time-series processing
- Forecasting
- Machine-learning foundations
- MLOps and model serving
- Distributed execution
- Streaming processing
- Kafka integration
- RabbitMQ and WebSocket messaging
- DAG orchestration
- Agent and tool-governance capabilities
- Observability and profiling
- Package signing and verification
- SBOM and provenance tooling
- Release-integrity and compatibility gates
PeaLang is designed around a simple idea:
Extend existing systems instead of replacing them.
It can be used as an application scripting and orchestration layer while existing services continue to use technologies such as Python, Java, FastAPI, JavaScript, TypeScript, React, SQL, Kafka, and other established platforms.
Typical use cases include:
Use PeaLang as an extension or scripting language inside another application.
Define workflows, tasks, pipelines, DAGs, and distributed operations.
Work with structured data, databases, DataFrames, connectors, streams, and analytical workloads.
Build event-processing workflows with streaming, windowing, Kafka, messaging systems, and WebSockets.
Develop data-processing, forecasting, ML, MLOps, serving, and production inference workflows.
Connect PeaLang workloads to existing applications and infrastructure instead of requiring complete rewrites.
PeaLang's current pre-1.0 compatibility work targets modern Python environments.
For development, create an isolated environment.
python -m venv .venv
.venv\Scripts\activatepython3 -m venv .venv
source .venv/bin/activateUpgrade the packaging tools:
python -m pip install --upgrade pip setuptools wheelInstall PeaLang from the project directory:
pip install -e .Create:
hello.pea
Example:
let name = "PeaLang"
print("Hello from " + name)
Run it using the PeaLang CLI:
pea run hello.peaUse the CLI help for the commands supported by your installed version:
pea --helpPeaLang has evolved into a layered runtime:
PeaLang Application
|
+------------+------------+
| |
Interpreter Compiler
| |
| Bytecode
| |
+------------+------------+
|
VM
|
+-------------+-------------+
| | |
Standard Connectors Tooling
Library
| | |
+-----+-----+ | +-----+-----+
| | | | |
Data ML/AI Cloud Debugging Profiling
| | |
| Serving Messaging
| | |
+-----------+-------+
|
Orchestration
|
Distributed Execution
The PeaLang runtime contains implementations for core language processing and execution, including:
Parser
Interpreter
Compiler
Bytecode
Virtual Machine
Type System
Module System
Package System
Standard Library
Async Runtime
Structured Concurrency
The project also maintains compatibility and public-API snapshots as part of the stabilization process.
PeaLang includes functionality targeting data-oriented workloads.
Areas include:
DataFrames
SQL
Database connectivity
Object storage
Cloud connectors
Analytics
Time series
Forecasting
Streaming
Windowing
This allows PeaLang programs to move beyond simple scripting and participate in larger data pipelines.
PeaLang includes capabilities for event-driven and streaming applications.
These include:
- Streaming execution
- Windowing
- Kafka
- RabbitMQ
- WebSockets
- Messaging connectors
- Stateful processing
- DAG orchestration
These capabilities are intended to allow PeaLang programs to coordinate batch, event-driven, and streaming workflows.
PeaLang's ML-oriented capabilities include areas such as:
ML foundations
Forecasting
Production ML
Secure MLOps
Model serving
Resilient serving
Distributed serving
The goal is not to replace established ML ecosystems, but to provide a language and orchestration layer capable of integrating them into PeaLang workflows.
PeaLang includes infrastructure for scalable workloads, including:
- DAG orchestration
- Distributed compute
- Scalable execution
- Streaming
- Distributed serving
- State management
- Recovery and resilience mechanisms
PeaLang's primary runtime integrates closely with Python and can be embedded into Python-based systems.
PeaLang contains FastAPI integration for applications that want PeaLang execution behind HTTP APIs and services.
A Java SDK is provided under:
java-sdk/
The pre-1.0 compatibility program includes validation against modern Java environments.
The TypeScript SDK is located under:
typescript-sdk/
It supports modern TypeScript compilation and Node module resolution.
A React integration is available under:
react-sdk/
It provides the foundation for integrating PeaLang-backed functionality into React applications.
Browser integration is available under:
browser-sdk/
PeaLang also contains WebAssembly-related runtime functionality for browser-oriented use cases.
PeaLang provides tooling for language development and application debugging.
This includes:
- Debug Adapter Protocol support
- VM debugging
- Profiling
- Coverage support
- Semantic analysis
- Runtime diagnostics
- Conformance testing
- Performance regression infrastructure
Run the Python test suite with:
pytestSpecific tests can be executed with:
pytest tests/PeaLang maintains regression tests across multiple generations of the language to reduce the risk of accidentally removing historical capabilities.
The project also contains dedicated compatibility, conformance, retention, security, packaging, and release-integrity tests.
Backward capability retention is an explicit PeaLang development principle.
The repository maintains historical information including:
Historical capability ledger
Historical release index
Retention reports
Public API snapshots
Version history
Compatibility reports
Approved-removal records
A capability should not disappear silently during development.
Intentional removals should be explicitly documented and approved.
PeaLang contains security functionality covering areas such as:
- Package verification
- Signed packages
- Ed25519 signatures
- Registry integrity
- Security boundaries
- Supply-chain validation
- Dependency auditing
- Security regression testing
- Provenance
- SBOM generation
Security validation remains part of the final v1.0 release process.
PeaLang's release architecture includes support for:
SHA-256 artifact verification
SBOM generation
Provenance
package signatures
Release manifests
Public API snapshots
Compatibility evidence
Retention evidence
For v1.0, these mechanisms are intended to be applied to the exact final release artifacts.
A simplified project layout:
PeaLang/
|
+-- pealang/ # Main language/runtime
+-- tests/ # Regression and validation tests
+-- docs/ # Documentation
+-- examples/ # PeaLang examples
|
+-- java-sdk/ # Java integration
+-- typescript-sdk/ # TypeScript SDK
+-- react-sdk/ # React integration
+-- browser-sdk/ # Browser integration
|
+-- release/ # Release policy/configuration
+-- release-evidence/ # Release certification evidence
+-- tools/ # Development/release tooling
|
+-- .github/
| +-- workflows/ # CI and validation
|
+-- pyproject.toml
+-- README.md
+-- CHANGELOG.md
+-- ROADMAP.md
Project documentation is maintained under:
docs/
Key starting points include:
docs/BASICS.md
docs/STANDARD_LIBRARY.md
docs/PACKAGES.md
docs/BYTECODE_AND_VM.md
docs/ASYNC_VM.md
docs/EMBEDDING.md
docs/FASTAPI_INTEGRATION.md
docs/JAVA_REACT_INTEROP.md
docs/DEBUG_ADAPTER.md
docs/RELEASE_INTEGRITY.md
Additional documentation covers data engineering, connectors, streaming, machine learning, orchestration, distributed execution, security, migration, compatibility, and release engineering.
PeaLang follows incremental development with compatibility and retention checks between releases.
The project is currently in the:
0.99.x -> 1.0.0
stabilization phase.
Feature development is effectively frozen while remaining release-certification work is completed.
See:
CHANGELOG.md
ROADMAP.md
docs/project/VERSION_HISTORY.md
docs/releases/
for detailed release history.
PeaLang v0.99.5 is a pre-1.0 stabilization release.
Core implementation is substantially complete, while final release certification remains in progress.
Current areas of final validation include:
- Full regression validation
- Windows/Linux/macOS compatibility
- Python version compatibility
- Java 17/21 SDK validation
- Node 20/22/24 SDK validation
- Security scanning
- Clean installation
- Offline installation
- Wheel validation
- Source distribution validation
- Container validation
- Reproducibility
- SBOM generation
- Provenance
- Artifact signing
- Final release approvals
A workflow or validation framework being present does not automatically mean that the corresponding v1.0 certification has passed.
Final v1.0 readiness requires retained evidence produced against the final release candidate.
PeaLang follows a fail-closed release policy.
A release should not be declared ready merely because the implementation builds successfully.
The final release gate considers:
Regression
Historical retention
API stability
Compatibility
Security
Packaging
Installation
Supply-chain integrity
Documentation
Release evidence
Approvals
Missing required release evidence results in a NO-GO rather than an assumed PASS.
The immediate objective is:
The remaining work focuses on stabilization and release certification rather than adding major new feature families.
The intended sequence is:
Pre-1.0 stabilization
|
Regression certification
|
Compatibility certification
|
Security certification
|
Packaging certification
|
Supply-chain evidence
|
Release approvals
|
PeaLang 1.0.0
See ROADMAP.md for the detailed project roadmap.
Contributions should preserve PeaLang's historical compatibility and release-integrity principles.
Before submitting a change:
pytestFor changes affecting public APIs, packaging, SDKs, security, compatibility, or release behavior, also run the relevant specialized validation suites.
Changes should:
- Preserve existing functionality unless removal is intentional.
- Include regression tests for new behavior.
- Document public-facing changes.
- Update the changelog where appropriate.
- Avoid committing generated build artifacts.
- Avoid undocumented breaking changes.
Generated build output should not be treated as canonical PeaLang source.
Examples include:
build/
dist/
target/
*.egg-info/
__pycache__/
.pytest_cache/
node_modules/
coverage/
These artifacts should normally be generated during build, test, packaging, or release processes rather than maintained as source.
Each PeaLang release should maintain:
- Cumulative
CHANGELOG.md - Version-specific release notes
- Updated README
- Version history
- User documentation
- Basics/foundation documentation
- Upgrade and migration guidance
- Retention evidence
- Compatibility evidence
- Release-integrity evidence
This keeps both historical evolution and current usage discoverable.
PeaLang is currently a pre-1.0 project.
The project has entered API and feature stabilization, but users should still expect final packaging, compatibility, and release-certification changes before v1.0.0.
Production adoption should therefore evaluate the specific PeaLang release and its accompanying compatibility and release evidence.
See the repository's LICENSE file for licensing terms.
Current version : 0.99.5
Development phase : Pre-1.0 stabilization
Feature development : Frozen for 1.0
Historical retention : Enabled
Compatibility gates : Enabled
Security gates : Enabled
Release certification : In progress
Target milestone : PeaLang 1.0.0
Build small scripts. Embed them anywhere. Scale them into real systems.
db2addac6b8fb56baaf01e368d039587cec51eaf